CVE-2025-6024

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites

State: Published
Severity: 6.1 Medium
Published: Apr 16, 2026
Updated: Apr 16, 2026
Reserved: Jun 12, 2025

Description

The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	WSO2

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
WSO2 API ManagerWSO2	before 3.1.0Unknown 3.1.0 to before 3.1.0.351Affected 3.2.0 to before 3.2.0.455Affected 3.2.1 to before 3.2.1.74Affected 4.0.0 to before 4.0.0.375Affected 4.1.0 to before 4.1.0.238Affected
WSO2 Identity ServerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.360Affected 5.11.0 to before 5.11.0.405Affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.